366de21f4e6d87120134c43a03b3e659a94ff4cb81b5968b51e454948e897548

Analysis

max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
Size 1.6MB
Sample261014-eamylafx7n
SHA256 366de21f4e6d87120134c43a03b3e659a94ff4cb81b5968b51e454948e897548
MD5 c1f7f0e84304a454541f346b67b9487b
SHA1 4f6e5eb5a2d084f5c0dd365896bf410d3fb45b2e
SHA512 232b2824ce9132cb8edd602b05dde248597fd77ff3732a90e5ea4dc831374f63aeb12fafce9016a045a16a30b84b6848e984bd290254eaba4f887adc483823e0
SSDEEP 49152:wbfcx2eIzRet6PPwyo2MIvJtoiQKusITOirx:wgx/My6vJ+guV
TLSH
T19A75CF52729080BAC4B611B0A26D4769EEF0FAA14271CD0BB7C4394D5F709D2B63E7B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3396	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
3396	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
3396	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
3396	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
408	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
408	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
408	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
408	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
408	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
408	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 408	3396	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_32c182580"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autorun.txt

Path C:\Users\Admin\AppData\Local\Temp\pkg_32c182580\autorun.txt
Size 98B
SHA256 9cf97ba4927d0967a3615d34723d10f8b22e765b2912768caee16ee9323bc505
MD5 847faad37c837f04f27458e897883d87
SHA1 0166a748e8310f9b777d986ae92c41f12b3dde16
SHA512 6cf2aadc746218b753f8f975d4bcef0e93955c9019f39276f59ae88962e3920fa63b0b7a0ef48de53f67edb47ab9724d498bde9b35e65c5780e3042681ec4d3b
TLSH
T1EBB01206141407D911D148BD40123343D32011244484F03794CF303E0F032420754049
MD5 SHA1 SHA512 TLSH

Submit Download

wrapper.xml

Path C:\Users\Admin\AppData\Local\Temp\pkg_32c182580\wrapper.xml
Size 1KB
SHA256 9a7e0e42263fce0d4521921818a757ff2ca485d16052e8e3287bc281a323daf6
MD5 3db83f039ef0c6d0f9a2db8e02ab744a
SHA1 f0ef7f3666933e3d46f2467f7a48722078de6615
SHA512 ba9b807533475d4629b6c798e1fb5ea6a385e26885023461c0167a7effd1878875be5a5c3206c1d04e06c45a929eb841d2bb53663628874b2f030cb2ae0155f1
TLSH
T17411294D4AE419B33AF6BD52EBB6220CAE9350CB21B98C16FC89159F462718144B35D7
MD5 SHA1 SHA512 TLSH

Submit Download